Privacy Policy

What we collect

• Account details: full name, username, role, unit, committee, represented country, language preference. Entered by the organising team.
• Contact details: email address and phone number (optional).
• Application lookup: the five-character application code issued by the organising team, and full name.
• Conference records: attendance, chairboard feedback, answers to the 22:00 hotel check, accommodation status.
• Messages between a delegate and their PR contact or chairboard.
• Optional: notification subscription and game scores.

What we do not collect

• We do not ask for or store national ID numbers, passport numbers or any other official document number.
• We do not access location, contacts, photo library or files on your device. The camera runs only while scanning an attendance code; no image is stored or sent to the server.
• No payment details, health data, religion, political opinion or other special category data is collected.

Why we process it

• To take attendance, deliver the schedule and announcements, connect delegates with their PR contact, run the application process and look after delegates staying in conference accommodation.
• Data is not used for advertising and is not sold to third parties.

Who can see it

• The organising team sees attendance and accommodation records. A PR member sees only the messages and curfew alerts of delegates assigned to them.
• Chairs see attendance only for their own committee and write feedback for those delegates.
• Administrator accounts can access all records.
• Delegates see only each other’s name and represented country.

Where it is stored

• In a PostgreSQL database hosted on servers within the European Union (Frankfurt). The application runs on Vercel.
• Passwords are never stored in plain text; they are hashed with bcrypt.
• Attendance QR codes are signed with a per-person secret; rotating that secret invalidates older codes.

How long we keep it

• Conference records are kept for at most one year after the event and then deleted.
• To have your account deleted, write to the address below; the account and its messages, attendance and feedback records are removed.

Your rights

• Under Turkish Law No. 6698 (KVKK) and the GDPR you may request access to your data, its correction or deletion, and object to its processing.
• Send such requests to the address below.

Children’s data

• The app is for conference participants. Data of participants under eighteen is entered by the organising team with the consent of a parent or their school.

Contact